1

I wrote a simple IDAPython script that only prints out local functions and ignores library functions. But somehow, it prints every single function. Here is the script:

import idc, idautils
for func in idautils.Functions():
    flags = idc.GetFunctionFlags(func)
    # Ignore library functons
    if flags & FUNC_LIB:
        continue
    print idc.GetFunctionName(func)

I based my script from the second code snippet in this tutorial (http://researchcenter.paloaltonetworks.com/2016/06/unit42-using-idapython-to-make-your-life-easier-part-6/).

  • Try checking the segment: idc.SegName(start) != 'extern' – Nordwald Jan 10 '17 at 6:43
  • Thank you, your method works. Just to elaborate for anyone else interested. Aside from 'extern,' I also need to make sure that segment name is not ".plt," ".init," or ".fini." So to simplify the code, I just check if segment name equals ".text" or not. – yellowbyte Jan 10 '17 at 7:31
1

This is a confusion of terminology. In IDA-speak, "library function" means "a function from a (compiler) standard library", i.e. a function recognised by a FLIRT signature (usually colored in cyan). These are encountered in practice mostly in statically-linked Windows executables. On Linux and OS X the standard functions usually come from shared libraries so you will need another way to distinguish them - e.g. what what was suggested in the comments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.